Cisco released fixes for Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition to address high-severity SQL injection vulnerability.
“An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system”, Cisco reports.
“A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges”.
Cisco Unified CM and Unified CM SME, which are intended as enterprise call and session management systems, guarantee the compatibility of apps like Webex, Jabber, and more while upholding availability and security.
The vulnerability is tracked as CVE-2023-20010 (CVSS score of 8.1). It arises because user input in the web-based management interface of the platforms is not properly validated.
The flaw enables a remote, authenticated attacker to attack a system that is vulnerable to a SQL injection attack.
Cisco mentions that there are no workarounds for this vulnerability.
The security flaw impacts Cisco Unified CM and Unified CM SME versions 11.5(1), 12.5(1), and 14, and was fixed in version 12.5(1)SU7 of the applications. A patch will also be included in version 14SU3, which is expected in March 2023.
Hence, customers are encouraged to update to a relevant fixed software release.
Network Security Checklist – Download Free E-Book
A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID…
The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google…
Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by…
Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers,…
Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…
A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…
![](data:image/svg+xml;charset=utf-8,<svg height="79px" width="602px" xmlns="http://www.w3.org/2000/svg" version="1.1"/>)
%20(1).webp?w=1600&resize=1600,900&ssl=1)
%20(1).webp?w=1600&resize=1600,900&ssl=1)